We discovered a critical vulnerability in isolated-vm a sandbox that is widely used in popular AI-related projects | Blog | Endor Labs
-->
C support for AI SAST now available.<br>Learn More
Solutions
Research
Resources
LeanAppSec
Docs
Pricing
Login
Book a Demo
Book Demo
By clicking “Accept”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
DenyAccept
18px_cookie
e-remove
Customize your preferences
Essential<br>Required
These items are required to enable basic website functionality.
Marketing
Essential<br>These items are used to deliver advertising that is more relevant to you and your interests.
Analytics
Essential<br>These items help the website operator understand how its website performs, how visitors interact with the site, and whether there may be technical issues.
Personalization
Essential<br>These items allow the website to remember choices you make (such as your user name, language, or the region you are in) and provide enhanced, more personal features.
Remove all cookiesSave & submit
Blog<br>GHSA-864f-rcv7-6rh4: Critical Type Confusion Vulnerability in isolated-vm<br>We discovered a critical vulnerability in isolated-vm (1M+ weekly downloads), a sandbox that is widely used in popular AI-related projects like n8n, Activepieces, or Mastra AI. We demonstrated how attackers can weaponize this vulnerability to achieve control-flow hijacking and sandbox escape.
Written by<br>Cris Staicu
Published on<br>August 20, 2026
Updated on<br>August 20, 2026
Topics<br>Open Source<br>Security<br>News
Summarize with AI
TL;DR<br>We discovered a critical vulnerability (GHSA-864f-rcv7-6rh4; pending CVE assignment) in isolated-vm, a widely used library for running untrusted JavaScript inside a V8 Isolate.<br>A type confusion in ExternalCopy's handling of the transferList option lets code running inside the sandbox corrupt memory in the host process. Starting from nothing but a single ivm.Reference, the standard way hosts hand a sandbox any capability at all, we escalated the bug from a controlled-address crash all the way to hijacking the host's control flow, demonstrating a full guest-to-host sandbox escape.<br>V8 is the JavaScript engine behind Chrome and Node.js, and an Isolate is its unit of separation: an instance with its own heap and its own copy of the built-ins, sharing no object graph with any other Isolate. isolated-vm is the Node.js package that gives each sandbox one of its own, which is why untrusted code running inside cannot touch anything in the host process unless the embedder deliberately passes it across. That boundary is what a sandbox escape has to defeat.<br>The most important takeaway is that what was not broken was the isolation primitive itself. V8's Isolate boundary held. What failed was the C++ glue code that marshals values across that boundary. A perfectly sound building block was undermined by the binding layer wrapped around it.<br>Affected versions
Package Name<br>Advisory<br>Version<br>Published (UTC)<br>Status<br>Severity
isolated-vm<br>GHSA-864f-rcv7-6rh4
August 8, 2026<br>Fixed<br>Critical
isolated-vm<br>GHSA-864f-rcv7-6rh4
August 8, 2026<br>Fixed<br>Critical
Introduction<br>Running untrusted JavaScript safely is one of the hardest problems in the Node.js ecosystem, and its history is littered with failures. vm2, for years the default answer, accumulated more than twenty documented breakouts before being deprecated. We wrote about one of the most recent ones. The reason vm2 kept failing is architectural: it tried to build a security boundary inside a single V8 context using JavaScript-level tricks (proxies, prototype scrubbing), and untrusted code shares the same heap, the same prototypes, and the same Function constructor as the sandbox itself. Every escape was a variation on reaching back across a boundary that was never really there.<br>isolated-vm takes a fundamentally stronger approach. Instead of partitioning one context, it gives each sandbox its own V8 Isolate , i.e., a separate heap, a separate set of built-ins, and no shared object graph with the host. This is the same primitive Chrome uses to separate tabs. Guest code gets no require, no host globals, and no references to host objects unless the embedder explicitly hands them over. That is a real, OS-and-VM-enforced boundary, and it is why isolated-vm is trusted to run genuinely adversarial code.<br>That trust is well-earned, and that is precisely why this finding is interesting. We did not break the V8 Isolate . We broke the code that carries data into it.<br>isolated-vm is the sandbox of record for a wide range of production systems. The project's own documentation lists Screeps (an MMO that runs player-supplied code), Fly.io (edge compute), Algolia (its Custom Crawler), and TripAdvisor (server-side rendering).<br>Its role has only grown with the rise of AI agents and automation platforms, where the core requirement is executing model- or user-generated...